This vulnerability (CWE-98) in ThemeREX Skyward (<=1.10) involves improper control of filenames used in PHP include or require statements, enabling unauthenticated local file inclusion. An attacker can exploit this flaw to include arbitrary files on the server, potentially leading to remote code execution or disclosure of sensitive information. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability. No official patch or remediation level is currently documented, and no known exploits are reported in the wild.

Successful exploitation allows unauthenticated attackers to include local files on the server, which can lead to disclosure of sensitive data, remote code execution, and full system compromise. The vulnerability affects confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to vulnerable installations and consider disabling or restricting PHP include/require functionality if feasible. Monitor for vendor updates regarding patches or official mitigations.